Hi  @Justin_Seattle 

It seemed like you had done all the troubleshooting steps. To better understand the issue, we need more details:

1. Around how many wireless clients in total in the network?

2. Are all IOS clients having this issue? Or some yes, some not?

3. A screenshot/video when the issue happened, please include the error message;

4. How often will this issue happen? Or it's only happening when moving?

5. When did you first notice this issue? Since the installation? Or it works perfectly for sometime before this issue first happen?

  @Vincent-TP 

Thanks for responding:

1) l have about 50 wireless devices in the network

2) It started with iOS devices . iPhones had issues on and off but seem to be having fewer issues lately -- started about a month ago. It seemed like turning off the extra MAC address privacy was key to getting the other devices back on the network. But in addition to this in the last 2 weeks now the Macs are having issues. One Mac absolutely refused to join any network -- had to revert to hard wired via USB. That Mac did get back on the network in a different part of the house.

3) I'm not sure what diagnostics you are asking for. It's just a pop up saying unable to join network. Are you asking someone from the Omada controller side? 
4) It's periodic -- once a week. I don't think it happens without moving, but that is hard to k ow as phones and laptops are naturally mobile.

5) Worked perfectly until about a month ago and started with the phones. 

Hi  @Justin_Seattle 

Thanks for the detailed reply.

So turning off the extra MAC address privacy seemed crucial for getting other devices back on the network.

About the Mac, how could you make it connect to the WLAN again? Require a reboot on the mac, or anything else?

In the meantime, it's recommended to do some wireless optimization on the EAP units:

How to optimize wireless performance of EAP products

  @Vincent-TP 

It seemed to reconnect from a differt part of the house -- likely a different AP. 

Is there any debugging that can be done on either the Omada side or the device side -- logging that can be turned on to see what the Mac is doing and what if anything Omada sees? 

Hi  @Justin_Seattle 

You may export the running log, search the MAC address of the Mac, and check the related logs.

  @Justin_Seattle 

Some strange things with apple devices

I have issues with previous AP (OpenWISP) and Omada too

I have found the miraculous setting of Apple forum (aka DTIM and Beacon Interval)

For each band and after no Password failure on IOS

  @Justin_Seattle 

Maybe onto a solution....

Thinking more about this, with the help of prompting from questions here, I'm not sure this is actually an Apple problem. I think it might just be a Roaming or WPA authentication issue. Because my *only* devices that move around the house are Apple devices. iPhones and Macs. I do think that things really were improved by turning off mac randomization on the iphones, but maybe this other stuff is a scond issue. All my other devices are stationary so only Apples devices roam. I read in another thread about WPA authentication errors that the physical layout of the hardwired network between the router and various switches can cause issues that look like mine. In particular the poster said they had exactly the same switch topology I have set up and it was problematic -- I have the ER7206 v2.0 router with the WAN input and I have 3 unmanaged TP-Link switches coming off the LAN ports on the ER7206 and various APs coming off the different switches. 

Instead the poster said that what solved it was a single "main" switch coming off the ER7206 router and then the other switches coming off the main switch rather than off other LAN ports on the router. I have changed the ethernet cables around to implement this topology. So far no problems since the change, but as it's infrequent more time will tell. I'll update if this is the solution. 

Also, does anyone know *why* the switch topology can cause problems? Is there a most ideal topology? For example should all the APs come off a single switch maybe? Then all the subswitches just used for hardwired clients? 

  @Justin_Seattle 

my topology is a Debian PC acting as router with a switch card, and a trunk go to a SG2008P managed switch, and another trunk from the debian go to GS110TP, and a third trunk is between a gs108T and SG2008P

One ap is directly connected to switch of my Debian, one on GS110TP and one on SG2008P

i don't have roaming issues with my settings posted above but all switches are managed

i already have issues with customers with unmanaged switches, like one have a Chinese unmanaged switch and he don't have internet on a eap610 when he links eap with this switch, only lan access, I placed one of my older switch (gs108e) and internet was ok. I don't know why his unmanaged switch filter the trafic